Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-96366Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96365Webform - Less critical - Denial of service - SA-CONTRIB-2026-170Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96364Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96357Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96398Webform - Less critical - Access bypass - SA-CONTRIB-2026-173Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96356Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96355Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96375Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176Packagist · drupal/cloud · fixed in 7.0.1
- CVE-2026-96376Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177Packagist · drupal/cloud · fixed in 7.0.1
- CVE-2026-96374Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178Packagist · drupal/project_browser · fixed in 2.0.3, 2.1.5
- CVE-2026-96384Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180Packagist · drupal/mermaid_diagram_field · fixed in 1.0.9
- CVE-2026-96379CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181Packagist · drupal/cookiecuttr · fixed in 2.0.3
- CVE-2026-96385REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182Packagist · drupal/rest_api_authentication · fixed in 3.2.0
- CVE-2026-96388Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184Packagist · drupal/tawk_to · fixed in 3.0.4
- CVE-2026-96390Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185Packagist · drupal/editoria11y · fixed in 2.2.23, 3.0.9
- CVE-2026-96391Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186Packagist · drupal/webform_rest · fixed in 4.2.1
- CVE-2026-96392AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187Packagist · drupal/ai_ckeditor · fixed in 1.4.3
- CVE-2026-96377Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188Packagist · drupal/combined_image_style · fixed in 1.0.7
- CVE-2026-96380CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189Packagist · drupal/css_usage_analyzer · fixed in 1.0.2
- CVE-2026-96386Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190Packagist · drupal/smart_content · fixed in 3.2.1
- CVE-2026-96382Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191Packagist · drupal/diba_carousel · fixed in 3.0.2
- CVE-2026-114509Laravel TokenGuard authentication bypass through non-string API credentialsPackagist · laravel/framework · fixed in 13.29.0, 12.68.0
- CVE-2026-114508Laravel relationship inclusion can trigger unauthorized data destructionPackagist · laravel/framework · fixed in 12.68.0, 13.27.0
- CVE-2026-114501Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1PyPI · pillow · fixed in 13.0.0
- CVE-2026-96639Pillow multi-frame loaders can reuse stale native image storage after mode transitionsPyPI · pillow · fixed in 13.0.0
- CVE-2026-96636Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)PyPI · pillow · fixed in 13.0.0
- CVE-2026-96640Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustionPyPI · pillow · fixed in 13.0.0
- CVE-2026-96637Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoSPyPI · pillow · fixed in 13.0.0
- CVE-2026-96778Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills bufferPyPI · pillow · fixed in 13.0.0
- CVE-2026-96643Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic timePyPI · pillow · fixed in 13.0.0